Threat P.L.HuiPCHS-iP.3.3

URI: P.L.HuiPCHS-iP.3.3

Package: Network

< prev | next >

Description: Unattended console access to interactive process Process on device host Host in Space: an attacker with physical access to device Host in location Space is able to access process Process via the console while the legitimate user is away from the desk.

Threat Type: Primary Threat

Matching Pattern:

P.L.HuiPCHS-iP.3.3
MP-HuiPCHS-iP

Finds a Human interacting with a Process running on a Host which is not their personal device, located in a space, plus associated process access contexts.

        (empty)

        (empty)

        (empty)

CSG-AutomaticScreenLock

Host device Host is configured with an automated screen lock activated after a suitably short period of inactivity, requiring user Human to re-authenticate before resuming a session.

CSG-IgnorePhysicalThreatsFromWorld

Indicates that threats from as well as to the space Space can be ignored, i.e. that the risk model intentionally does not consider physical attacks from Space. This is only permitted if Space is the inferred global public space (the World) used when no locations are asserted in the model. This control strategy is a way to specify that physical security is out of scope for devices with no explicitly specified location(s), i.e. that they are considered physically secure.

CSG-PersonalDeviceOversight

Device Host is a personal device dedicated to one user, who will protect it from some types of attacks involving ongoing physical access or evident alteration of the device. For these threats, the protection level is very good because a momentary lapse in attention from the user is not sufficient to allow the attack.

CSG-UserSecurityTraining

Users in the role Human are trained to avoid most common cyber security errors by using only strong passwords, recognising malicious emails, and the importance of physical security including the use of screen locking for fixed devices that cannot be carried on the person.